IPoE Subscriber Management Configuration

IP-over-Ethernet (IPoE) is an access technology that uses DHCP for IPv4 and DHCPv6 for IPv6 where both protocols are handled in the IPoE daemon (ipoed). IPoE subscribers are identified by IFP, VLANs and client MAC addresses.

The dynamic creation of IPoE subscribers is triggered by DHCPv4 discover or DHCPv6 solicit request from the subscriber. Response is postponed until the subscriber is successfully authenticated using the known authentication methods such as local or RADIUS, however authentication is not mandatory. After the authentication phase, IPv4/IPv6/IPv6-PD address is allocated to the subscriber either from the local pool or from RADIUS.

For IPoE Subscriber Management, the following configurations are mandatory:

  1. Access Interface Configuration

  2. Access Profile Configuration

  3. AAA (Authentication, Authorization and Accounting) Profile Configuration. Based on the authentication requirement, configure any one of the following:

    1. Local Authentication

      1. Pool Configuration

      2. User Profile Configuration

    2. RADIUS Authentication

      1. RADIUS Profile Configuration

      2. RADIUS Server Configuration

This solution section discusses RADIUS authentication.

NOTES:

  • Access interfaces can be configured without VLAN tags (untagged) and with one (single tagged) or two (double tagged) VLAN tags.

  • There can be more than one interface configured for subscriber management and each interface can reference the same profile.

Configuring IPoE Subscriber Management

For detailed information about the subscriber configuration options, see the Subscriber Management Configuration Guide.

  1. Configure the access profile ipoe.

set access access-profile ipoe
set access access-profile ipoe instance default
set access access-profile ipoe protocol ra enable true
set access access-profile ipoe protocol ra interval 30
set access access-profile ipoe protocol dhcp enable true
set access access-profile ipoe protocol dhcp lease-time 60
set access access-profile ipoe protocol dhcpv6 enable true
set access access-profile ipoe protocol dhcpv6 lifetime 60
set access access-profile ipoe address-family ipv4 enable true
set access access-profile ipoe address-family ipv4 pool-name pool1
set access access-profile ipoe address-family ipv6 enable true
set access access-profile ipoe address-family ipv6 pool-name pool1
set access access-profile ipoe address-family ipv6 prefix-delegation-pool-name pool2
commit

The access profile configuration is shown below.

supervisor@rtbrick: op> show config access access-profile
{
  "rtbrick-config:access-profile": [
    {
      "profile-name": "ipoe",
      "instance": "default",
      "protocol": {
        "ra": {
          "enable": "true",
          "interval": 30
        },
        "dhcp": {
          "enable": "true",
          "lease-time": 60
        },
        "dhcpv6": {
          "enable": "true",
          "lifetime": 60
        }
      },
      "address-family": {
        "ipv4": {
          "enable": "true",
          "pool-name": "pool1"
        },
        "ipv6": {
          "enable": "true",
          "pool-name": "pool1",
          "prefix-delegation-pool-name": "pool2"
        }
      }
    }
  ]
}

  1. Configure the Authentication and Accounting (AAA) profile for aaa-profile.

set access aaa-profile ipoe-aaa
set access aaa-profile ipoe-aaa session-timeout 0
set access aaa-profile ipoe-aaa idle-timeout 0
set access aaa-profile ipoe-aaa aaa-radius-profile aaa-radius1
set access aaa-profile ipoe-aaa authentication order RADIUS
set access aaa-profile ipoe-aaa accounting order RADIUS
set access aaa-profile ipoe-aaa accounting interim-interval 30
set access aaa-profile ipoe-aaa accounting session-id-format DEFAULT
commit

The access AAA configuration is shown below.

supervisor@rtbrick: op> show config access aaa-profile
{
  "rtbrick-config:aaa-profile": [
    {
      "profile-name": "ipoe-aaa",
      "session-timeout": 0,
      "idle-timeout": 0,
      "aaa-radius-profile": "aaa-radius1",
      "authentication": {
        "order": "RADIUS"
      },
      "accounting": {
        "order": "RADIUS",
        "interim-interval": 30,
        "session-id-format": "DEFAULT"
      }
    }
  ]
}

  1. Configure the access interface. Double-tagged interface is configured in this case as the LAG interfaces (lag-1 for Multiservice Edge1 and lag-11 for Multiservice Edge2). The interface configuration assigns the access type, access profile, AAA profile, and further optional attributes like service-profile to the specified access interface.

Access interface (lag-1) commands for Multiservice Edge1.

set access interface double-tagged lag-1 1001 1100 1001 1100
set access interface double-tagged lag-1 1001 1100 1001 1100 access-type IPoE
set access interface double-tagged lag-1 1001 1100 1001 1100 access-profile-name ipoe
set access interface double-tagged lag-1 1001 1100 1001 1100 service-profile-name qos_service
set access interface double-tagged lag-1 1001 1100 1001 1100 aaa-profile-name ipoe-aaa
set access interface double-tagged lag-1 1001 1100 1001 1100 gateway-ifl lo-0/0/0/10
set access interface double-tagged lag-1 1001 1100 1001 1100 redundancy-session-id 100
commit

The double-tagged lag-1 interface configuration for Multiservice Edge1 is shown below.

supervisor@rtbrick: op> show config access interface
{
  "rtbrick-config:interface": {
    "double-tagged": [
      {
        "interface-name": "lag-1",
        "outer-vlan-min": 1001,
        "outer-vlan-max": 1100,
        "inner-vlan-min": 1001,
        "inner-vlan-max": 1100,
        "access-type": "IPoE",
        "access-profile-name": "ipoe",
        "service-profile-name": "qos_service",
        "aaa-profile-name": "ipoe-aaa",
        "gateway-ifl": "lo-0/0/0/10",
        "redundancy-session-id": 100
      }
    ]
  }
}

Access interface (lag-11) commands for Multiservice Edge2.

set access interface double-tagged lag-11 1101 1200 1001 1100
set access interface double-tagged lag-11 1101 1200 1001 1100 access-type IPoE
set access interface double-tagged lag-11 1101 1200 1001 1100 access-profile-name ipoe
set access interface double-tagged lag-11 1101 1200 1001 1100 service-profile-name qos_service
set access interface double-tagged lag-11 1101 1200 1001 1100 aaa-profile-name ipoe-aaa
set access interface double-tagged lag-11 1101 1200 1001 1100 gateway-ifl lo-0/0/0/10
set access interface double-tagged lag-11 1101 1200 1001 1100 redundancy-session-id 200
commit

The double-tagged lag-11 interface configuration for Multiservice Edge.2 is shown below.

supervisor@rtbrick: op> show config access interface
{
  "rtbrick-config:interface": {
    "double-tagged": [
      {
        "interface-name": "lag-11",
        "outer-vlan-min": 1101,
        "outer-vlan-max": 1200,
        "inner-vlan-min": 1001,
        "inner-vlan-max": 1100,
        "access-type": "IPoE",
        "access-profile-name": "ipoe",
        "service-profile-name": "qos_service",
        "aaa-profile-name": "ipoe-aaa",
        "gateway-ifl": "lo-0/0/0/10",
        "redundancy-session-id": 200
      }
    ]
  }
}

  1. In this solution, we configure AAA authentication and accounting with RADIUS. To use RADIUS authentication and accounting both the RADIUS profile and RADIUS server configurations (see below) must be configured.

  1. Configure RADIUS profile aaa-radius1.

set access radius-profile aaa-radius1
set access radius-profile aaa-radius1 nas-identifier 198.51.100.1
set access radius-profile aaa-radius1 nas-port-type Ethernet
set access radius-profile aaa-radius1 authentication radius-server-profile-name radius-srv1
set access radius-profile aaa-radius1 accounting radius-server-profile-name radius-srv1
commit

The RADIUS profile configuration is shown below.

supervisor@rtbrick: op> show config access radius-profile aaa-radius1
{
  "rtbrick-config:radius-profile": [
    {
      "profile-name": "aaa-radius1",
      "nas-identifier": "198.51.100.1",
      "nas-port-type": "Ethernet",
      "authentication": {
        "radius-server-profile-name": [
          "radius-srv1"
          ]
      },
      "accounting": {
        "radius-server-profile-name": [
          "radius-srv1"
          ]
      }
    }
  ]
}

  1. Configure the RADIUS server radius.

set access radius-server radius-srv1
set access radius-server radius-srv1 address 198.51.100.20
set access radius-server radius-srv1 source-address 198.51.100.1
set access radius-server radius-srv1 secret-encrypted-text $2b2feb12f730107454b1be6a0f8242b0f
set access radius-server radius-srv1 routing-instance default
set access radius-server radius-srv1 authentication enable true
set access radius-server radius-srv1 authentication timeout 10
set access radius-server radius-srv1 accounting enable true
set access radius-server radius-srv1 accounting timeout 10
set access radius-server radius-srv1 coa enable true
commit
The attribute` secret-plain-text` will be converted to secret-encrypted-text in the show command output and value will be hashed.

The RADIUS server configuration is shown below.

supervisor@rtbrick: op> show config access radius-server radius-srv1
{
  "rtbrick-config:radius-server": [
    {
      "server-name": "radius-srv1",
      "address": "198.51.100.20",
      "source-address": "198.51.100.1",
      "secret-encrypted-text": "$2b2feb12f730107454b1be6a0f8242b0f",
      "routing-instance": "default",
      "authentication": {
        "enable": "true",
        "timeout": 10
      },
      "accounting": {
        "enable": "true",
        "timeout": 10
      },
      "coa": {
        "enable": "true"
      }
    }
  ]
}

  1. Configure the IPv4 and IPv6 access pools.

set access pool pool1
set access pool pool1 ipv4-address low 11.100.128.1
set access pool pool1 ipv4-address high 15.100.128.255
set access pool pool1 ipv6-prefix low fc55:100:1:1::1/128
set access pool pool1 ipv6-prefix high fc55:100:1:2::5555/128
set access pool pool2
set access pool pool2 ipv6-prefix low fc56:100:1::/56
set access pool pool2 ipv6-prefix high fc56:100:5000::/56
commit

The access pool configuration is shown below.

supervisor@rtbrick: op> show config access pool
{
  "rtbrick-config:pool": [
    {
      "pool-name": "pool1",
      "ipv4-address": {
        "low": "11.100.128.1",
        "high": "15.100.128.255"
      },
      "ipv6-prefix": {
        "low": "fc55:100:1:1::1/128",
        "high": "fc55:100:1:2::5555/128"
      }
    },
    {
      "pool-name": "pool2",
      "ipv6-prefix": {
        "low": "fc56:100:1::/56",
        "high": "fc56:100:5000::/56"
      }
    }
  ]
}

IPoE Quality of Service (QoS) Configuration

The QoS model explained in this document uses a complex HQoS model with the intent to showcase the complete range of QoS features available in RBFS. However, it may not be needed or desirable for all deployments. In such a case it should be possible to conceive of a simple QoS model as required by simplifying the provided QoS model.

Following are the steps involved in configuring and verifying IPoE QoS:

  1. Configuring service profile to enable QoS on IPoE subscriber locally

  2. Configuring downstream QoS

  3. Configuring upstream QoS

  4. Configuring QoS remarking

  5. Configuring IPoE subscriber accounting for upstream and downstream traffic

  6. Configuring IPoE subscribers QoS on BNG Blaster

  7. Validating IPoE QoS on BNG Blaster

The figure below shows how QoS is configured for ingress and egress traffic.

qos design
Figure 1. Hierarchical Quality of Service primitives

For detailed information about the QoS configuration options, see the HQoS Configuration Guide.

Configure Service Profile

Service profile configuration in subscriber management allows to assign QoS configurations to a subscriber.

  1. Configure the service profile to enable QoS. The service profile defined to enable Quality of Service with profile name is qos_service.

set access service-profile qos_service qos profile subs-4q-profile
commit

The configuration of the service profile named qos_service is shown below.

supervisor@rtbrick: op> show config access service-profile qos_service
{
  "rtbrick-config:service-profile": [
    {
      "profile-name": "qos_service",
      "qos": {
        "profile": "subs-4q-profile"
      }
    }
  ]
}

  1. Enable QoS on IPoE subscriber access interface (lag-1) to enable QoS for IPoE subscriber.

set access interface double-tagged lag-1 1001 1100 1001 1100 service-profile-name qos_service
commit

Below is the double-tagged access interface on which the service profile qos_service is configured.

supervisor@rtbrick: op> show config access interface double-tagged
{
  "rtbrick-config:double-tagged": [
    {
      "interface-name": "lag-1",
      "outer-vlan-min": 1001,
      "outer-vlan-max": 1100,
      "inner-vlan-min": 1001,
      "inner-vlan-max": 1100,
      "access-type": "IPoE",
      "access-profile-name": "ipoe",
      "service-profile-name": "qos_service",
      "aaa-profile-name": "ipoe-aaa",
      "gateway-ifl": "lo-0/0/0/10",
      "redundancy-session-id": 100
    }
  ]
}

  1. Configure QoS profile to enable on IPoE subscriber.

set forwarding-options class-of-service profile subs-4q-profile
set forwarding-options class-of-service profile subs-4q-profile classifier-name subs-4q-classifier
set forwarding-options class-of-service profile subs-4q-profile class-queue-map-name subs-4q-class-queue
set forwarding-options class-of-service profile subs-4q-profile remark-map-name subs-4q-remark
set forwarding-options class-of-service profile subs-4q-profile class-policer-map-name subs-4q-class-policer
set forwarding-options class-of-service profile subs-4q-profile policer-name subs-4q-policer
set forwarding-options class-of-service profile subs-4q-profile scheduler-map-name subs-4q-scheduler
commit

The QoS Profile with all the primitives needed to enable traffic profiles on IPoE Subscribers is as follows:

supervisor@rtbrick: op> show config forwarding-options class-of-service profile subs-4q-profile
{
  "rtbrick-config:profile": [
    {
      "profile-name": "subs-4q-profile",
      "classifier-name": "subs-4q-classifier",
      "class-queue-map-name": "subs-4q-class-queue",
      "remark-map-name": "subs-4q-remark",
      "class-policer-map-name": "subs-4q-class-policer",
      "policer-name": "subs-4q-policer",
      "scheduler-map-name": "subs-4q-scheduler"
    }
  ]
}

Configure Downstream QoS

Downstream Quality of Service (QoS) is used to prioritize network traffic from the Internet to subscribers.

  1. Enable global classification for downstream traffic.

set forwarding-options class-of-service global multifield-classifier-name global_mfc
commit

Below is the multi-field-classifier (MFC) based classifier for global enabling of downstream traffic classification.

supervisor@rtbrick: op> show config forwarding-options class-of-service global multifield-classifier-name
{
  "rtbrick-config:multifield-classifier-name": "global_mfc"
}

  1. Configure the MFC-based classifier with qualifiers and actions.

set forwarding-options class-of-service multifield-classifier acl l3v4 rule global_mfc
set forwarding-options class-of-service multifield-classifier acl l3v4 rule global_mfc ordinal 1001
set forwarding-options class-of-service multifield-classifier acl l3v4 rule global_mfc ordinal 1001 match
set forwarding-options class-of-service multifield-classifier acl l3v4 rule global_mfc ordinal 1001 match ipv4-tos 128
set forwarding-options class-of-service multifield-classifier acl l3v4 rule global_mfc ordinal 1001 match source-ipv4-prefix 192.0.2.54/32
set forwarding-options class-of-service multifield-classifier acl l3v4 rule global_mfc ordinal 1001 action
set forwarding-options class-of-service multifield-classifier acl l3v4 rule global_mfc ordinal 1001 action forward-class class-0
set forwarding-options class-of-service multifield-classifier acl l3v4 rule global_mfc ordinal 1002
set forwarding-options class-of-service multifield-classifier acl l3v4 rule global_mfc ordinal 1002 match
set forwarding-options class-of-service multifield-classifier acl l3v4 rule global_mfc ordinal 1002 match ipv4-tos 160
set forwarding-options class-of-service multifield-classifier acl l3v4 rule global_mfc ordinal 1002 match source-ipv4-prefix 192.0.2.54/32
set forwarding-options class-of-service multifield-classifier acl l3v4 rule global_mfc ordinal 1002 action
set forwarding-options class-of-service multifield-classifier acl l3v4 rule global_mfc ordinal 1002 action forward-class class-1
set forwarding-options class-of-service multifield-classifier acl l3v4 rule global_mfc ordinal 1003
set forwarding-options class-of-service multifield-classifier acl l3v4 rule global_mfc ordinal 1003 match
set forwarding-options class-of-service multifield-classifier acl l3v4 rule global_mfc ordinal 1003 match ipv4-tos 192
set forwarding-options class-of-service multifield-classifier acl l3v4 rule global_mfc ordinal 1003 match source-ipv4-prefix 192.0.2.54/32
set forwarding-options class-of-service multifield-classifier acl l3v4 rule global_mfc ordinal 1003 action
set forwarding-options class-of-service multifield-classifier acl l3v4 rule global_mfc ordinal 1003 action forward-class class-2
set forwarding-options class-of-service multifield-classifier acl l3v4 rule global_mfc ordinal 1004
set forwarding-options class-of-service multifield-classifier acl l3v4 rule global_mfc ordinal 1004 match
set forwarding-options class-of-service multifield-classifier acl l3v4 rule global_mfc ordinal 1004 match ipv4-tos 224
set forwarding-options class-of-service multifield-classifier acl l3v4 rule global_mfc ordinal 1004 match source-ipv4-prefix 192.0.2.54/32
set forwarding-options class-of-service multifield-classifier acl l3v4 rule global_mfc ordinal 1004 action
set forwarding-options class-of-service multifield-classifier acl l3v4 rule global_mfc ordinal 1004 action forward-class class-3
commit

The configuration of the QoS MFC-based Classifier for classification of downstream traffic from the core towards IPoE Subscriber is shown below.

supervisor@rtbrick: op> show config forwarding-options class-of-service multifield-classifier acl l3v4 rule global_mfc
{
  "rtbrick-config:rule": [
    {
      "rule-name": "global_mfc",
      "ordinal": [
        {
          "ordinal-value": 1001,
          "match": {
            "ipv4-tos": 128,
            "source-ipv4-prefix": "192.0.2.54/32"
          },
          "action": {
            "forward-class": "class-0"
          }
        },
        {
          "ordinal-value": 1002,
          "match": {
            "ipv4-tos": 160,
            "source-ipv4-prefix": "192.0.2.54/32"
          },
          "action": {
            "forward-class": "class-1"
          }
        },
        {
          "ordinal-value": 1003,
          "match": {
            "ipv4-tos": 192,
            "source-ipv4-prefix": "192.0.2.54/32"
          },
          "action": {
            "forward-class": "class-2"
          }
        },
        {
          "ordinal-value": 1004,
          "match": {
            "ipv4-tos": 224,
            "source-ipv4-prefix": "192.0.2.54/32"
          },
          "action": {
            "forward-class": "class-3"
          }
        }
      ]
    }
  ]
}

  1. Enqueue classified traffic to different queues using class-to-queue mapping.

set forwarding-options class-of-service queue-group subs-4q-class-queue queue-numbers 4
set forwarding-options class-of-service class-queue-map subs-4q-class-queue
set forwarding-options class-of-service class-queue-map subs-4q-class-queue class class-0
set forwarding-options class-of-service class-queue-map subs-4q-class-queue class class-0 queue-name BE_SUBS
set forwarding-options class-of-service class-queue-map subs-4q-class-queue class class-1
set forwarding-options class-of-service class-queue-map subs-4q-class-queue class class-1 queue-name LD_SUBS
set forwarding-options class-of-service class-queue-map subs-4q-class-queue class class-2
set forwarding-options class-of-service class-queue-map subs-4q-class-queue class class-2 queue-name LL_SUBS
set forwarding-options class-of-service class-queue-map subs-4q-class-queue class class-3
set forwarding-options class-of-service class-queue-map subs-4q-class-queue class class-3 queue-name VO_SUBS
commit

Below is the QoS class-queue mapping configuration:

supervisor@rtbrick: op> show config forwarding-options class-of-service class-queue-map subs-4q-class-queue class
{
  "rtbrick-config:class": [
    {
      "class-type": "class-0",
      "queue-name": "BE_SUBS"
    },
    {
      "class-type": "class-1",
      "queue-name": "LD_SUBS"
    },
    {
      "class-type": "class-2",
      "queue-name": "LL_SUBS"
    },
    {
      "class-type": "class-3",
      "queue-name": "VO_SUBS"
    }
  ]
}

  1. Configure the queues needed for enqueuing and dequeuing traffic streams.

set forwarding-options class-of-service queue BE_SUBS
set forwarding-options class-of-service queue BE_SUBS queue-size 375000
set forwarding-options class-of-service queue LD_SUBS
set forwarding-options class-of-service queue LD_SUBS queue-size 625000
set forwarding-options class-of-service queue LL_SUBS
set forwarding-options class-of-service queue LL_SUBS queue-size 625000
set forwarding-options class-of-service queue VO_SUBS
set forwarding-options class-of-service queue VO_SUBS queue-size 156250
set forwarding-options class-of-service queue VO_SUBS shaper-name shaper_VO
commit

The queue Configuration is shown below.

supervisor@rtbrick: op> show config forwarding-options class-of-service queue
{
  "rtbrick-config:queue": [
    {
      "queue-name": "BE_SUBS",
      "queue-size": 375000
    },
    {
      "queue-name": "LD_SUBS",
      "queue-size": 625000
    },
    {
      "queue-name": "LL_SUBS",
      "queue-size": 625000
    },
    {
      "queue-name": "VO_SUBS",
      "queue-size": 156250,
      "shaper-name": "shaper_VO"
    }
  ]
}

  1. Configure the scheduler needed by Subscriber/Session scheduler-map and OLT scheduler-map.

set forwarding-options class-of-service scheduler pon0
set forwarding-options class-of-service scheduler pon0 shaper-name gpon-shaper
set forwarding-options class-of-service scheduler pon0 type fair_queueing
set forwarding-options class-of-service scheduler subs-4q-class-queue
set forwarding-options class-of-service scheduler subs-4q-class-queue shaper-name shaper_session
set forwarding-options class-of-service scheduler subs-4q-class-queue type strict_priority
commit

The configuration of the scheduler-map and OLT scheduler-map is shown below.

supervisor@rtbrick: op> show config forwarding-options class-of-service scheduler
{
  "rtbrick-config:scheduler": [
    {
      "scheduler-name": "pon0",
      "shaper-name": "gpon-shaper",
      "type": "fair_queueing"
    },
    {
      "scheduler-name": "subs-4q-class-queue",
      "shaper-name": "shaper_session",
      "type": "strict_priority"
    }
  ]
}

  1. Configure the session/subscriber scheduler mapping for dequeuing traffic based on scheduler type for each queue:

set forwarding-options class-of-service scheduler-map subs-4q-scheduler
set forwarding-options class-of-service scheduler-map subs-4q-scheduler queue-group-name subs-4q-class-queue
set forwarding-options class-of-service scheduler-map subs-4q-scheduler queue-group-name subs-4q-class-queue queue-name BE_SUBS
set forwarding-options class-of-service scheduler-map subs-4q-scheduler queue-group-name subs-4q-class-queue queue-name BE_SUBS parent-flow high-flow
set forwarding-options class-of-service scheduler-map subs-4q-scheduler queue-group-name subs-4q-class-queue queue-name BE_SUBS parent-scheduler-name subs-4q-class-queue
set forwarding-options class-of-service scheduler-map subs-4q-scheduler queue-group-name subs-4q-class-queue queue-name BE_SUBS connection-point strict_priority_3
set forwarding-options class-of-service scheduler-map subs-4q-scheduler queue-group-name subs-4q-class-queue queue-name LD_SUBS
set forwarding-options class-of-service scheduler-map subs-4q-scheduler queue-group-name subs-4q-class-queue queue-name LD_SUBS parent-flow high-flow
set forwarding-options class-of-service scheduler-map subs-4q-scheduler queue-group-name subs-4q-class-queue queue-name LD_SUBS parent-scheduler-name subs-4q-class-queue
set forwarding-options class-of-service scheduler-map subs-4q-scheduler queue-group-name subs-4q-class-queue queue-name LD_SUBS connection-point strict_priority_1
set forwarding-options class-of-service scheduler-map subs-4q-scheduler queue-group-name subs-4q-class-queue queue-name LL_SUBS
set forwarding-options class-of-service scheduler-map subs-4q-scheduler queue-group-name subs-4q-class-queue queue-name LL_SUBS parent-flow high-flow
set forwarding-options class-of-service scheduler-map subs-4q-scheduler queue-group-name subs-4q-class-queue queue-name LL_SUBS parent-scheduler-name subs-4q-class-queue
set forwarding-options class-of-service scheduler-map subs-4q-scheduler queue-group-name subs-4q-class-queue queue-name LL_SUBS connection-point strict_priority_2
set forwarding-options class-of-service scheduler-map subs-4q-scheduler queue-group-name subs-4q-class-queue queue-name VO_SUBS
set forwarding-options class-of-service scheduler-map subs-4q-scheduler queue-group-name subs-4q-class-queue queue-name VO_SUBS parent-flow high-flow
set forwarding-options class-of-service scheduler-map subs-4q-scheduler queue-group-name subs-4q-class-queue queue-name VO_SUBS parent-scheduler-name subs-4q-class-queue
set forwarding-options class-of-service scheduler-map subs-4q-scheduler queue-group-name subs-4q-class-queue queue-name VO_SUBS connection-point strict_priority_0
set forwarding-options class-of-service scheduler-map subs-4q-scheduler scheduler-name subs-4q-class-queue
set forwarding-options class-of-service scheduler-map subs-4q-scheduler scheduler-name subs-4q-class-queue port-connection scheduler_to_port
commit

The QoS Subscriber/Session Scheduler-Map configuration is shown below:

supervisor@rtbrick: op> show config forwarding-options class-of-service scheduler-map subs-4q-scheduler
{
  "rtbrick-config:scheduler-map": [
    {
      "scheduler-map-name": "subs-4q-scheduler",
      "queue-group-name": [
        {
          "group-name": "subs-4q-class-queue",
          "queue-name": [
            {
              "name": "BE_SUBS",
              "parent-flow": "high-flow",
              "parent-scheduler-name": "subs-4q-class-queue",
              "connection-point": "strict_priority_3"
            },
            {
              "name": "LD_SUBS",
              "parent-flow": "high-flow",
              "parent-scheduler-name": "subs-4q-class-queue",
              "connection-point": "strict_priority_1"
            },
            {
              "name": "LL_SUBS",
              "parent-flow": "high-flow",
              "parent-scheduler-name": "subs-4q-class-queue",
              "connection-point": "strict_priority_2"
            },
            {
              "name": "VO_SUBS",
              "parent-flow": "high-flow",
              "parent-scheduler-name": "subs-4q-class-queue",
              "connection-point": "strict_priority_0"
            }
          ]
        }
      ],
      "scheduler-name": [
        {
          "name": "subs-4q-class-queue",
          "port-connection": "scheduler_to_port"
        }
      ]
    }
  ]
}

  1. Configure the OLT scheduler-mapping for each PON to be scheduled according to the scheduler type.

set forwarding-options class-of-service scheduler-map schedmap-olt
set forwarding-options class-of-service scheduler-map schedmap-olt scheduler-name pon0
set forwarding-options class-of-service scheduler-map schedmap-olt scheduler-name pon0 port-connection scheduler_to_port
commit

The OLT Scheduler-Map configuration is shown below:

supervisor@rtbrick: op> show config forwarding-options class-of-service scheduler-map schedmap-olt
{
  "rtbrick-config:scheduler-map": [
    {
      "scheduler-map-name": "schedmap-olt",
      "scheduler-name": [
        {
          "name": "pon0",
          "port-connection": "scheduler_to_port"
        }
      ]
    }
  ]
}

  1. Configure downstream traffic shaping for both session schedulers and queues.

Queue Shaping is only on VO_SUBS Queue session. 
set forwarding-options class-of-service shaper gpon-shaper
set forwarding-options class-of-service shaper gpon-shaper shaping-rate-high 2488000
set forwarding-options class-of-service shaper gpon-shaper shaping-rate-low 32000
set forwarding-options class-of-service shaper shaper_VO
set forwarding-options class-of-service shaper shaper_VO shaping-rate-high 2000
set forwarding-options class-of-service shaper shaper_VO shaping-rate-low 0
set forwarding-options class-of-service shaper shaper_session
set forwarding-options class-of-service shaper shaper_session shaping-rate-high 10000
set forwarding-options class-of-service shaper shaper_session shaping-rate-low 100
commit

The shaping Configuration is shown below.

supervisor@rtbrick: op> show config forwarding-options class-of-service shaper
{
  "rtbrick-config:shaper": [
    {
      "shaper-name": "gpon-shaper",
      "shaping-rate-high": 2488000,
      "shaping-rate-low": 32000
    },
    {
      "shaper-name": "shaper_VO",
      "shaping-rate-high": 2000,
      "shaping-rate-low": 0
    },
    {
      "shaper-name": "shaper_session",
      "shaping-rate-high": 10000,
      "shaping-rate-low": 100
    }
  ]
}

Configure Upstream QoS

  1. Configure the BA Classifier for the classification of multiple traffic streams targeted at IPoE subscribers:

set forwarding-options class-of-service classifier subs-4q-classifier
set forwarding-options class-of-service classifier subs-4q-classifier match-type ieee-802.1
set forwarding-options class-of-service classifier subs-4q-classifier match-type ieee-802.1 codepoint 1
set forwarding-options class-of-service classifier subs-4q-classifier match-type ieee-802.1 codepoint 1 class class-0
set forwarding-options class-of-service classifier subs-4q-classifier match-type ieee-802.1 codepoint 1 remark-codepoint 30
set forwarding-options class-of-service classifier subs-4q-classifier match-type ieee-802.1 codepoint 2
set forwarding-options class-of-service classifier subs-4q-classifier match-type ieee-802.1 codepoint 2 class class-1
set forwarding-options class-of-service classifier subs-4q-classifier match-type ieee-802.1 codepoint 2 remark-codepoint 60
set forwarding-options class-of-service classifier subs-4q-classifier match-type ieee-802.1 codepoint 3
set forwarding-options class-of-service classifier subs-4q-classifier match-type ieee-802.1 codepoint 3 class class-2
set forwarding-options class-of-service classifier subs-4q-classifier match-type ieee-802.1 codepoint 3 remark-codepoint 90
set forwarding-options class-of-service classifier subs-4q-classifier match-type ieee-802.1 codepoint 4
set forwarding-options class-of-service classifier subs-4q-classifier match-type ieee-802.1 codepoint 4 class class-3
set forwarding-options class-of-service classifier subs-4q-classifier match-type ieee-802.1 codepoint 4 remark-codepoint 120
commit

The configuration of the QoS BA-based Classifier for classification of upstream traffic towards IPoE Subscriber is shown below.

supervisor@rtbrick: op> show config forwarding-options class-of-service classifier subs-4q-classifier
{
  "rtbrick-config:classifier": [
    {
      "classifier-name": "subs-4q-classifier",
      "match-type": [
        {
          "match-type": "ieee-802.1",
          "codepoint": [
            {
              "codepoint": 1,
              "class": "class-0",
              "remark-codepoint": 30
            },
            {
              "codepoint": 2,
              "class": "class-1",
              "remark-codepoint": 60
            },
            {
              "codepoint": 3,
              "class": "class-2",
              "remark-codepoint": 90
            },
            {
              "codepoint": 4,
              "class": "class-3",
              "remark-codepoint": 120
            }
          ]
        }
      ]
    }
  ]
}

  1. Configure multi-level policer to police 4-Level traffic.

set forwarding-options class-of-service policer subs-4q-policer
set forwarding-options class-of-service policer subs-4q-policer level1-rates
set forwarding-options class-of-service policer subs-4q-policer level1-rates cir 2000
set forwarding-options class-of-service policer subs-4q-policer level1-rates cbs 1000
set forwarding-options class-of-service policer subs-4q-policer level2-rates
set forwarding-options class-of-service policer subs-4q-policer level2-rates cir 3000
set forwarding-options class-of-service policer subs-4q-policer level2-rates cbs 1000
set forwarding-options class-of-service policer subs-4q-policer level3-rates
set forwarding-options class-of-service policer subs-4q-policer level3-rates cir 4000
set forwarding-options class-of-service policer subs-4q-policer level3-rates cbs 1000
set forwarding-options class-of-service policer subs-4q-policer level4-rates
set forwarding-options class-of-service policer subs-4q-policer level4-rates cir 1000
set forwarding-options class-of-service policer subs-4q-policer level4-rates cbs 1000
set forwarding-options class-of-service policer subs-4q-policer levels 4
set forwarding-options class-of-service policer subs-4q-policer type two-rate-three-color
commit

The multi-level policer configuration is shown below:

supervisor@rtbrick: op> show config forwarding-options class-of-service policer subs-4q-policer
{
  "rtbrick-config:policer": [
    {
      "policer-name": "subs-4q-policer",
      "level1-rates": {
        "cir": 2000,
        "cbs": 1000
      },
      "level2-rates": {
        "cir": 3000,
        "cbs": 1000
      },
      "level3-rates": {
        "cir": 4000,
        "cbs": 1000
      },
      "level4-rates": {
        "cir": 1000,
        "cbs": 1000
      },
      "levels": 4,
      "type": "two-rate-three-color"
    }
  ]
}

  1. Map the classified traffic streams to different policer levels using class-to-policer mapping:

set forwarding-options class-of-service class-policer-map subs-4q-class-policer
set forwarding-options class-of-service class-policer-map subs-4q-class-policer class class-0
set forwarding-options class-of-service class-policer-map subs-4q-class-policer class class-0 policer-level level-1
set forwarding-options class-of-service class-policer-map subs-4q-class-policer class class-1
set forwarding-options class-of-service class-policer-map subs-4q-class-policer class class-1 policer-level level-2
set forwarding-options class-of-service class-policer-map subs-4q-class-policer class class-2
set forwarding-options class-of-service class-policer-map subs-4q-class-policer class class-2 policer-level level-3
set forwarding-options class-of-service class-policer-map subs-4q-class-policer class class-3
set forwarding-options class-of-service class-policer-map subs-4q-class-policer class class-3 policer-level level-4
commit

The class-policer-map configuration is shown below:

supervisor@rtbrick: op> show config forwarding-options class-of-service class-policer-map subs-4q-class-policer class
{
  "rtbrick-config:class": [
    {
      "class": "class-0",
      "policer-level": "level-1"
    },
    {
      "class": "class-1",
      "policer-level": "level-2"
    },
    {
      "class": "class-2",
      "policer-level": "level-3"
    },
    {
      "class": "class-3",
      "policer-level": "level-4"
    }
  ]
}

Configure QoS Remarking

  1. Remark downstream traffic egressing from subscriber interface (egress remarking).

set forwarding-options class-of-service remark-map subs-4q-remark
set forwarding-options class-of-service remark-map subs-4q-remark remark-type ieee-802.1
set forwarding-options class-of-service remark-map subs-4q-remark remark-type ieee-802.1 match-codepoint 128
set forwarding-options class-of-service remark-map subs-4q-remark remark-type ieee-802.1 match-codepoint 128 color all
set forwarding-options class-of-service remark-map subs-4q-remark remark-type ieee-802.1 match-codepoint 128 color all remark-codepoint 6
set forwarding-options class-of-service remark-map subs-4q-remark remark-type ieee-802.1 match-codepoint 160
set forwarding-options class-of-service remark-map subs-4q-remark remark-type ieee-802.1 match-codepoint 160 color all
set forwarding-options class-of-service remark-map subs-4q-remark remark-type ieee-802.1 match-codepoint 160 color all remark-codepoint 6
set forwarding-options class-of-service remark-map subs-4q-remark remark-type ieee-802.1 match-codepoint 192
set forwarding-options class-of-service remark-map subs-4q-remark remark-type ieee-802.1 match-codepoint 192 color all
set forwarding-options class-of-service remark-map subs-4q-remark remark-type ieee-802.1 match-codepoint 192 color all remark-codepoint 6
set forwarding-options class-of-service remark-map subs-4q-remark remark-type ieee-802.1 match-codepoint 224
set forwarding-options class-of-service remark-map subs-4q-remark remark-type ieee-802.1 match-codepoint 224 color all
set forwarding-options class-of-service remark-map subs-4q-remark remark-type ieee-802.1 match-codepoint 224 color all remark-codepoint 6
commit

The remarking configuration is shown below:

supervisor@rtbrick: op> show config forwarding-options class-of-service remark-map subs-4q-remark
{
  "rtbrick-config:remark-map": [
    {
      "remark-map-name": "subs-4q-remark",
      "remark-type": [
        {
          "remark-type": "ieee-802.1",
          "match-codepoint": [
            {
              "match-codepoint": 128,
              "color": [
                {
                  "color": "all",
                  "remark-codepoint": 6
                }
              ]
            },
            {
              "match-codepoint": 160,
              "color": [
                {
                  "color": "all",
                  "remark-codepoint": 6
                }
              ]
            },
            {
              "match-codepoint": 192,
              "color": [
                {
                  "color": "all",
                  "remark-codepoint": 6
                }
              ]
            },
            {
              "match-codepoint": 224,
              "color": [
                {
                  "color": "all",
                  "remark-codepoint": 6
                }
              ]
            }
          ]
        }
      ]
    }
  ]
}

  1. Remark upstream traffic ingressing to a subscriber’s interface [ingress remarking]

In the upstream traffic classifier configuration shown below, remarking of all traffic streams with code point '7' is done. 
set forwarding-options class-of-service classifier subs-4q-classifier
set forwarding-options class-of-service classifier subs-4q-classifier match-type ieee-802.1
set forwarding-options class-of-service classifier subs-4q-classifier match-type ieee-802.1 codepoint 1
set forwarding-options class-of-service classifier subs-4q-classifier match-type ieee-802.1 codepoint 1 class class-0
set forwarding-options class-of-service classifier subs-4q-classifier match-type ieee-802.1 codepoint 1 remark-codepoint 30
set forwarding-options class-of-service classifier subs-4q-classifier match-type ieee-802.1 codepoint 2
set forwarding-options class-of-service classifier subs-4q-classifier match-type ieee-802.1 codepoint 2 class class-1
set forwarding-options class-of-service classifier subs-4q-classifier match-type ieee-802.1 codepoint 2 remark-codepoint 60
set forwarding-options class-of-service classifier subs-4q-classifier match-type ieee-802.1 codepoint 3
set forwarding-options class-of-service classifier subs-4q-classifier match-type ieee-802.1 codepoint 3 class class-2
set forwarding-options class-of-service classifier subs-4q-classifier match-type ieee-802.1 codepoint 3 remark-codepoint 90
set forwarding-options class-of-service classifier subs-4q-classifier match-type ieee-802.1 codepoint 4
set forwarding-options class-of-service classifier subs-4q-classifier match-type ieee-802.1 codepoint 4 class class-3
set forwarding-options class-of-service classifier subs-4q-classifier match-type ieee-802.1 codepoint 4 remark-codepoint 120
commit

Below is the remarking configuration:

supervisor@rtbrick: op> show config forwarding-options class-of-service classifier subs-4q-classifier
{
  "rtbrick-config:classifier": [
    {
      "classifier-name": "subs-4q-classifier",
      "match-type": [
        {
          "match-type": "ieee-802.1",
          "codepoint": [
            {
              "codepoint": 1,
              "class": "class-0",
              "remark-codepoint": 30
            },
            {
              "codepoint": 2,
              "class": "class-1",
              "remark-codepoint": 60
            },
            {
              "codepoint": 3,
              "class": "class-2",
              "remark-codepoint": 90
            },
            {
              "codepoint": 4,
              "class": "class-3",
              "remark-codepoint": 120
            }
          ]
        }
      ]
    }
  ]
}

Configure Mirroring for Downstream Traffic Remark Validation

Configure Mirroring for Downstream Traffic

set forwarding-options mirror m1 source interface lag-1
set forwarding-options mirror m1 source direction egress
set forwarding-options mirror m1 destination interface cpu-0/0/200
commit

Validate the downstream traffic remarking

This validation requires mirroring the subscriber access interface on the Multiservice Edge device. 
supervisor@rtbrick: op> show config forwarding-options mirror
{
  "rtbrick-config:mirror": [
    {
      "name": "m1",
      "destination": {
        "interface": "cpu-0/0/200"
      },
      "source": {
        "direction": "egress",
        "interface": "lag-1"
      }
    }
  ]
}

The capture mirroring can be performed as shown below.

supervisor@rtbrick: op> capture mirror | head -n 10
Success : Mirror capture started

2026-09-07T23:46:03.460982+0000 10:aa:aa:aa:aa:aa > 02:00:00:00:00:01, ethertype 802.1Q (0x8100), length 1022: vlan 1001, p 6, ethertype 802.1Q (0x8100), vlan 1001, p 6, ethertype IPv4 (0x0800), (tos 0xe0, ttl 61, id 0, offset 0, flags [DF], proto UDP (17), length 1000)
    192.0.2.54.65056 > 11.100.128.2.65056: UDP, length 972

2026-09-07T23:46:03.461055+0000 10:aa:aa:aa:aa:aa > 02:00:00:00:00:01, ethertype 802.1Q (0x8100), length 1022: vlan 1001, p 6, ethertype 802.1Q (0x8100), vlan 1001, p 6, ethertype IPv4 (0x0800), (tos 0xa0, ttl 61, id 0, offset 0, flags [DF], proto UDP (17), length 1000)
    192.0.2.54.65056 > 11.100.128.2.65056: UDP, length 972

2026-09-07T23:46:03.461091+0000 10:aa:aa:aa:aa:aa > 02:00:00:00:00:01, ethertype 802.1Q (0x8100), length 1022: vlan 1001, p 6, ethertype 802.1Q (0x8100), vlan 1001, p 6, ethertype IPv4 (0x0800), (tos 0x80, ttl 61, id 0, offset 0, flags [DF], proto UDP (17), length 1000)
    192.0.2.54.65056 > 11.100.128.2.65056: UDP, length 972

Configure Mirroring for Upstream Traffic Remark Validation

set forwarding-options mirror m1 source interface lag-1
set forwarding-options mirror m1 source direction ingress
set forwarding-options mirror m1 destination interface cpu-0/0/200
commit

Validating the upstream traffic remarking

Mirror the core facing port on the Multiservice Edge device as shown below. 
supervisor@rtbrick: op> show config forwarding-options mirror
{
  "rtbrick-config:mirror": [
    {
      "name": "m1",
      "destination": {
        "interface": "cpu-0/0/200"
      },
      "source": {
        "direction": "ingress",
        "interface": "lag-1"
      }
    }
  ]
}

The capture mirroring can be performed as shown below. It confirms all four traffic streams noted with codepoint=7.

supervisor@rtbrick: op> capture mirror | head -n 10
Success : Mirror capture started

2026-09-07T23:46:09.815379+0000 02:00:00:00:00:03 > 10:aa:aa:aa:aa:aa, ethertype 802.1Q (0x8100), length 1022: vlan 1001, p 3, ethertype 802.1Q (0x8100), vlan 1002, p 3, ethertype IPv4 (0x0800), (tos 0xc0, ttl 64, id 0, offset 0, flags [DF], proto UDP (17), length 1000)
    11.100.128.1.65056 > 192.0.2.54.65056: UDP, length 972

2026-09-07T23:46:09.815480+0000 02:00:00:00:00:01 > 10:aa:aa:aa:aa:aa, ethertype 802.1Q (0x8100), length 1022: vlan 1001, p 3, ethertype 802.1Q (0x8100), vlan 1001, p 3, ethertype IPv4 (0x0800), (tos 0xc0, ttl 64, id 0, offset 0, flags [DF], proto UDP (17), length 1000)
    11.100.128.2.65056 > 192.0.2.54.65056: UDP, length 972

2026-09-07T23:46:09.815554+0000 02:00:00:00:00:05 > 10:aa:aa:aa:aa:aa, ethertype 802.1Q (0x8100), length 1022: vlan 1001, p 1, ethertype 802.1Q (0x8100), vlan 1003, p 1, ethertype IPv4 (0x0800), (tos 0x80, ttl 64, id 0, offset 0, flags [DF], proto UDP (17), length 1000)
    11.100.128.3.65056 > 192.0.2.54.65056: UDP, length 972

Configure FreeRADIUS Server

Installation of FreeRADIUS

FreeRADIUS server can be installed on any Linux OS distribution. For information about installing FreeRADIUS, see Installing the FreeRADIUS Server.

Remove the Unsupported Files

It is necessary to remove echo, ntlm_auth, eap, echo, and mschap files once FreeRadius has been installed, since they are not required by this reference design. To remove these files, enter the following commands:

rm -rf /etc/freeradius/3.0/mods-enabled/echo
rm -rf /etc/freeradius/3.0/mods-enabled/ntlm_auth
rm -rf /etc/freeradius/3.0/mods-enabled/eap
rm -rf /etc/freeradius/3.0/mods-enabled/echo
rm -rf /etc/freeradius/3.0/mods-enabled/mschap

FreeRADIUS User and Group Settings

Using the following commands, one can set the user or group as root.

sed -i 's/User=freerad/User=root/g' /lib/systemd/system/freeradius.service
sed -i 's/Group=freerad/Group=root/g' /lib/systemd/system/freeradius.service

Run the command for reloading 'systemd' after user or group settings:

systemctl daemon-reload

Configure the FreeRADIUS Files

It is necessary to configure the FreeRADIUS files once FreeRadius has been installed. The configuration files can be found under /etc/freeradius/3.0/.

authorize

Using the following command, one can view the authorize file in its default location.

~:/etc/freeradius/3.0 # cat mods-config/files/authorize

Replace the content of the authorize file with the following:

$INCLUDE /etc/freeradius/3.0/users_file
This file can also be downloaded from the appendix (Appendix C: RADIUS Server Configuration).

users_file

The IPoE Users file (users_file) mentioned in the above section includes subscriber profile parameters as shown below.

DEFAULT User-Name =~ '^[0-9a-f\:]+@ipoe$', Cleartext-Password := 'ipoe'
    Service-Type = Framed-User,
    Class = "IPOE",
    Reply-Message = "FOOBAR Internet",
    RtBrick-DNS-Primary = 10.0.0.3,
    RtBrick-DNS-Secondary = 10.0.0.4,
    RtBrick-DNS-Primary-IPv6  = fc66:0::3,
    RtBrick-DNS-Secondary-IPv6 = fc66:0::4,
    Acct-Interim-Interval = 900,
    RtBrick-QoS-Profile = "subs-4q-profile"

The users_file can be created with the above content in the /etc/freeradius/3.0/ path. Alternatively, this file can be downloaded from the appendix section of this guide and placed at /etc/freeradius/3.0/.

clients.conf

Clients.conf file shall be configured with the expected RADIUS client IP address and secret.

client rtbrick {
        ipaddr          = 198.51.100.1
        secret          = testing123
        shortname       = rtbrick
        nas_type        = other
        require_message_authenticator = no
}
client rtbrick {
        ipaddr          = 198.51.100.2
        secret          = testing123
        shortname       = rtbrick
        nas_type        = other
        require_message_authenticator = no
}

The clients.conf file (/etc/freeradius/3.0/clients.conf) used for this reference design can be downloaded from the appendix section of this guide.

radiusd.conf

The radiusd.conf file should be configured with the expected RADIUS authentication and accounting parameters.

prefix = /usr
exec_prefix = /usr
sysconfdir = /etc
localstatedir = /var
sbindir = ${exec_prefix}/sbin
logdir = /var/log/freeradius
raddbdir = /etc/freeradius
radacctdir = ${logdir}/radacct
name = freeradius
confdir = ${raddbdir}
modconfdir = ${confdir}/mods-config
run_dir = ${localstatedir}/run/${name}
db_dir = ${raddbdir}
libdir = /usr/lib/freeradius
pidfile = ${run_dir}/${name}.pid
correct_escapes = true
max_request_time = 5
cleanup_delay = 0
max_requests = 16384
hostname_lookups = no
log {
    destination = files
    file = ${logdir}/radius.log
    stripped_names = no
    auth = yes
}
checkrad = ${sbindir}/checkrad
security {
    # user = radius
    # group = radius
    allow_core_dumps = no
    max_attributes = 200
    reject_delay = 0
    status_server = no
@openssl_version_check_config@
}
proxy_requests  = no
$INCLUDE clients.conf
thread pool {
    start_servers = 32
    max_servers = 128
    min_spare_servers = 8
    max_spare_servers = 16
    max_queue_size = 16384
    max_requests_per_server = 0
    auto_limit_acct = no
}
modules {
    $INCLUDE mods-enabled/
}
instantiate {
    files
    linelog
}
server default {
    listen {
        type = auth
        ipaddr = *
        port = 1812
    }
    listen {
        type = acct
        ipaddr = *
        port = 1813
    }
    authorize {
        update request {
            FreeRADIUS-Client-Shortname = "%{&request:Client-Shortname}"
        }
        if (&request:Client-Shortname == "rtbrick-server") {
            rtbrick-server-log
        }
        files
        pap
    }
    authenticate {
        pap
    }
    post-auth {
        if (&request:Client-Shortname == "rtbrick-server") {
            rtbrick-server-log
        }
        Post-Auth-Type REJECT {
            update reply {
                Reply-Message := "Login Failed. Please check your username and password."
            }
            attr_filter.access_reject
        }
    }
    preacct {
        ok
    }
    accounting {
        if (&request:Client-Shortname == "rtbrick-server") {
            rtbrick-server-log
        }
    ok
    }
    session {
    }
}

Radiusd.conf should be configured to use UDP ports 1812 and 1813 for authentication and accounting, respectively. Additionally, rtbrick-server-log should be added to the parameters for authorise, authenticate, and accounting.

The radiusd.conf file (/etc/freeradius/3.0/radiusd.conf) used for this reference design can be downloaded from the appendix section (Appendix C) of this guide.

dictionary.rtbrick

Add the RtBrick RADIUS dictionary (dictionary.rtbrick) to /usr/share/freeradius/dictionary.rtbrick and include it in` /usr/share/freeradius/dictionary`.

The dictionary.rtbrick contains the RBFS attributes in FreeRADIUS format.

  • Click here to download the radius_config.zip, which contains the dictionary.rtbrick file.

Stopping and Starting the FreeRADIUS Server for any Changes

For any changes, stop and restart the FreeRADIUS server.

To stop the server, enter the following command:

sudo service freeradius stop

To start the server, enter the following command:

sudo service freeradius start

The FreeRadius server is now ready to provide AAA (Authentication, Accounting & Authorization) services to logging in subscribers.

Displaying the RADIUS Service Status

Run the following command to determine whether RADIUS service is active:

sudo service freeradius status

Validating IPoE Subscriber Bring-Up

Using traffic streams on both upstream and downstream directions with traffic packets and bytes statistics, IPoE Subscriber sessions can be "ESTABLISHED".

The validation can be performed in two steps:

  1. Establishing the IPoE subscriber

  2. Pinging the subscriber IPv4/IPv6 address

BNG Blaster - IPoE Subscribers with Traffic Streams

Using BNG Blaster, which emulates IPoE clients, session traffic("session-traffic") and streams traffic with different code-points("streams"), one can test IPoE subscriber management feature.

The data traffic can be defined in Blaster by configuring session/streams traffic.

  • Session Traffic in Blaster can be enabled by specifying "autostart": true. Once the session is established, traffic starts automatically. Eventually if you want to stop or start the traffic (session or streams), press F7/F8.

  • Streams traffic in Blaster can be enabled by specifying stream-group-id at both streams ("streams":) and access interface levels (interfaces:access).

For information about using BNG Blaster, see Starting BNG Blaster.

Validating the IPoE Session on BNG Blaster

To validate the IPoE Session on BNG Blaster, switch to the Service Node. On the BNG Blaster terminal, the count of the "Established" session will be 1. Also, the logging of the same terminal will display "ALL SESSIONS ESTABLISHED" and "ALL SESSION TRAFFIC FLOWS VERIFIED" as highlighted in the below image.

In the image below, one can see the details of the established Single Subscriber session.

image
Figure 2. BNG Blaster Terminal View

Visit the following URL for more information on BNG Blaster:

https://rtbrick.github.io/bngblaster/

Viewing the Subscribers and the Subscriber Details on RBFS

Enter the following command to view the list of subscribers.

supervisor@rtbrick: op> show subscriber
Subscriber-Id           Interface           VLAN     Type    State
1369375761697341441     lag-1             1001:1001  IPoE    ESTABLISHED
1369375761697341442     lag-1             1001:1002  IPoE    ESTABLISHED
1369375761697341443     lag-1             1001:1003  IPoE    ESTABLISHED
1369375761697341444     lag-1             1001:1004  IPoE    ESTABLISHED
1369375761697341445     lag-1             1001:1005  IPoE    ESTABLISHED
2522297266304188417     lag-11            1101:1001  IPoE    STANDBY
2522297266304188418     lag-11            1101:1002  IPoE    STANDBY
2522297266304188419     lag-11            1101:1003  IPoE    STANDBY
2522297266304188420     lag-11            1101:1004  IPoE    STANDBY
2522297266304188421     lag-11            1101:1005  IPoE    STANDBY

Enter the following command to view the details of the subscriber with ID 216454257090494470.

supervisor@rtbrick: op> show subscriber 1369375761697341441 detail
Subscriber-Id: 1369375761697341441
  Type: IPoE
  State: ESTABLISHED
  Created: Mon Sep 07 23:42:35 GMT +0000 2026
  Interface: lag-1
  Outer VLAN: 1001 (802.1q)
  Inner VLAN: 1001
  Client MAC: 02:00:00:00:00:01
  Server MAC: 10:aa:aa:aa:aa:aa
  IFL: ipoe-lag-1/1369375761697341441
  Username: 02:00:00:00:00:01@ipoe
  Agent-Remote-Id: CBNG1.RTBRICK.1
  Agent-Circuit-Id: 0.0.0.0/0.0.0.0 eth 0:1
  Access-Profile: ipoe
  AAA-Profile: ipoe-aaa
  Service-Profile: qos_service
  Reply-Message: FOOBAR Internet
  Session-Timeout: 0 seconds (disabled)
  Idle-Timeout: 0 seconds (disabled)
  MTU: 1500, Profile: N/A
  IPv4:
    Instance: default
    Address: 11.100.128.2/255.255.255.255 Source: Pool (pool1) Active: True
    Primary DNS: 10.0.0.3
    Secondary DNS: 10.0.0.4
  IPv6:
    Instance: default
    Prefix: fc55:100:1:1::2/128 Source: Pool (pool1) Active: True
    Delegated Prefix: fc56:100:1:100::/56 Source: Pool (pool2) Active: True
    Primary DNS: fc66::3
    Secondary DNS: fc66::4
  Accounting:
    Session-Id: 1369375761697341441:1788824555
    Start-Time: 2026-09-07T23:42:35.910376+0000
    Interims Interval: 900 seconds

Pinging the Subscriber (source: IPOE) from Multiservice Edge

Before pinging a subscriber, use the show route <…​> command to display the subscriber IPs at the Multiservice Edge.

supervisor@rtbrick: op> show route ipv4 unicast source ipoe
Flags: & - Imported
Instance: default, AFI: ipv4, SAFI: unicast
Flags  Prefix/Label                                Source               Pref  Next Hop                                    Outgoing Interface
       11.100.128.1/32                             ipoe                    7  -                                           ipoe-lag-1/1369375761697341442
       11.100.128.2/32                             ipoe                    7  -                                           ipoe-lag-1/1369375761697341441
       11.100.128.3/32                             ipoe                    7  -                                           ipoe-lag-1/1369375761697341443
       11.100.128.4/32                             ipoe                    7  -                                           ipoe-lag-1/1369375761697341444
       11.100.128.5/32                             ipoe                    7  -                                           ipoe-lag-1/1369375761697341445
       16.100.128.1/32                             ipoe                    7  198.51.100.210                              lag-2/10
       16.100.128.2/32                             ipoe                    7  198.51.100.210                              lag-2/10
       16.100.128.3/32                             ipoe                    7  198.51.100.210                              lag-2/10
       16.100.128.4/32                             ipoe                    7  198.51.100.210                              lag-2/10
       16.100.128.5/32                             ipoe                    7  198.51.100.210                              lag-2/10
supervisor@rtbrick: op> show route ipv6 unicast source ipoe
Flags: & - Imported
Instance: default, AFI: ipv6, SAFI: unicast
Flags  Prefix/Label                                Source               Pref  Next Hop                                    Outgoing Interface
       fc55:100:1:1::1/128                         ipoe                    7  -                                           ipoe-lag-1/1369375761697341442
       fc55:100:1:1::2/128                         ipoe                    7  -                                           ipoe-lag-1/1369375761697341441
       fc55:100:1:1::3/128                         ipoe                    7  -                                           ipoe-lag-1/1369375761697341443
       fc55:100:1:1::4/128                         ipoe                    7  -                                           ipoe-lag-1/1369375761697341444
       fc55:100:1:1::5/128                         ipoe                    7  -                                           ipoe-lag-1/1369375761697341445
       fc56:100:1::/56                             ipoe                    7  fe80::ffff:ffff:ff00:3                      ipoe-lag-1/1369375761697341442
       fc56:100:1:100::/56                         ipoe                    7  fe80::ffff:ffff:ff00:1                      ipoe-lag-1/1369375761697341441
       fc56:100:1:200::/56                         ipoe                    7  fe80::ffff:ffff:ff00:5                      ipoe-lag-1/1369375761697341443
       fc56:100:1:300::/56                         ipoe                    7  fe80::ffff:ffff:ff00:7                      ipoe-lag-1/1369375761697341444
       fc56:100:1:400::/56                         ipoe                    7  fe80::ffff:ffff:ff00:9                      ipoe-lag-1/1369375761697341445
       fc66:100:1:1::1/128                         ipoe                    7  198.51.100.210                              lag-2/10
       fc66:100:1:1::2/128                         ipoe                    7  198.51.100.210                              lag-2/10
       fc66:100:1:1::3/128                         ipoe                    7  198.51.100.210                              lag-2/10
       fc66:100:1:1::4/128                         ipoe                    7  198.51.100.210                              lag-2/10
       fc66:100:1:1::5/128                         ipoe                    7  198.51.100.210                              lag-2/10
       fc67:100:1::/56                             ipoe                    7  198.51.100.210                              lag-2/10
       fc67:100:1:100::/56                         ipoe                    7  198.51.100.210                              lag-2/10
       fc67:100:1:200::/56                         ipoe                    7  198.51.100.210                              lag-2/10
       fc67:100:1:300::/56                         ipoe                    7  198.51.100.210                              lag-2/10
       fc67:100:1:400::/56                         ipoe                    7  198.51.100.210                              lag-2/10

From the above list, ping 203.0.113.1 as shown below.

supervisor@rtbrick: op> ping 198.51.100.56
ping to 198.51.100.56 60 byte packets
68 bytes from 198.51.100.56: icmp_seq=1 ttl=63 time=20.40 ms
68 bytes from 198.51.100.56: icmp_seq=2 ttl=63 time=20.02 ms
68 bytes from 198.51.100.56: icmp_seq=3 ttl=63 time=30.48 ms
68 bytes from 198.51.100.56: icmp_seq=4 ttl=63 time=41.12 ms
68 bytes from 198.51.100.56: icmp_seq=5 ttl=63 time=20.44 ms
--- 198.51.100.56 ping statistics ---
5 sent, 5 received, 0 errors, 0.00% loss, time 5016.33 ms
rtt min/avg/max/mdev = 20.02/26.49/41.12/8.31 ms

Validating Traffic Streams

Traffic streams can be used to perform various forwarding verifications.

For upstream traffic capture, enter the following command:

capture interface ifp-0/1/30 direction in

For downstream traffic capture, enter the following command:

capture interface ifp-0/1/30 direction out

Here, ifp-0/1/30 refers to the access interface.

Validating the IPoE QoS on BNG Blaster

To validate the IPoE QoS on BNG Blaster, switch to the Service Node. Navigate to the Streams and Session Traffic terminal by pressing F1 function key in your keyboard.

Blaster Upstream Downstream QoSValidation
Figure 3. Reading output from BNG Blaster

As shown in the above image, the VoIP downstream traffic has been shaped (session shaping) to 2Mbps. Similarly, the total subscriber traffic has been shaped approximately to 10Mbps.

Following are the upstream traffic rates of different policer levels:

  • Level-1 Rates ~=2.5Mbps

  • Level-2 Rates ~=3.5Mbps

  • Level-3 Rates ~=4.5Mbps

  • Level-4 Rates ~=1.5Mbps

IPoE Subscriber Accounting for Upstream and Downstream Traffic

Run the "show subscriber" command to view the list of subscribers.

supervisor@rtbrick: op> show subscriber
Subscriber-Id           Interface           VLAN     Type    State
1369375761697341441     lag-1             1001:1001  IPoE    ESTABLISHED
1369375761697341442     lag-1             1001:1002  IPoE    ESTABLISHED
1369375761697341443     lag-1             1001:1003  IPoE    ESTABLISHED
1369375761697341444     lag-1             1001:1004  IPoE    ESTABLISHED
1369375761697341445     lag-1             1001:1005  IPoE    ESTABLISHED
2522297266304188417     lag-11            1101:1001  IPoE    ESTABLISHED
2522297266304188418     lag-11            1101:1002  IPoE    ESTABLISHED
2522297266304188419     lag-11            1101:1003  IPoE    ESTABLISHED
2522297266304188420     lag-11            1101:1004  IPoE    ESTABLISHED
2522297266304188421     lag-11            1101:1005  IPoE    ESTABLISHED

Specify the Subscriber-ID to find the specific subscriber’s accounting details:

supervisor@rtbrick: op> show subscriber 1369375761697341441 accounting
Subscriber-Id: 1369375761697341441
  IFL: ipoe-lag-1/1369375761697341441
  Start Timestamp: Mon Sep 07 23:42:35 GMT +0000 2026
  Idle Timestamp: Mon Sep 07 23:45:35 GMT +0000 2026
  Session-Timeout: 0 seconds
  Idle-Timeout: 0 seconds
  Session Statistics:
    Ingress: 220752 packets 221635008 bytes
    Egress: 144577 packets 147757694 bytes
  IFL Statistics:
    Ingress: 0 packets 0 bytes
    Egress: 0 packets 0 bytes
  Egress Class (Queue) Statistics:
    class-0: 36144 packets 36939168 bytes dropped: 0 packets 0 bytes
    class-1: 36144 packets 36939168 bytes dropped: 0 packets 0 bytes
    class-2: 36145 packets 36940190 bytes dropped: 0 packets 0 bytes
    class-3: 36144 packets 36939168 bytes dropped: 0 packets 0 bytes
    class-4: 0 packets 0 bytes dropped: 0 packets 0 bytes
    class-5: 0 packets 0 bytes dropped: 0 packets 0 bytes
    class-6: 0 packets 0 bytes dropped: 0 packets 0 bytes
    class-7: 0 packets 0 bytes dropped: 0 packets 0 bytes
  Ingress Policer Statistics:
    Level 1: 44307 packets 44484228 bytes dropped: 170133 packets 170813532 bytes
    Level 2: 65726 packets 65988904 bytes dropped: 148511 packets 149105044 bytes
    Level 3: 88486 packets 88839944 bytes dropped: 270519 packets 271601076 bytes
    Level 4: 22233 packets 22321932 bytes dropped: 144575 packets 145153300 bytes